From 3f563a1d117c6cacc0c2e68dae4f58c2b6b9daea Mon Sep 17 00:00:00 2001 From: adamsilverstein Date: Thu, 5 Mar 2026 14:48:56 +0700 Subject: [PATCH] Media: Skip cross-origin isolation for third-party page builders. Add a check to skip Document-Isolation-Policy when a third-party page builder overrides the block editor via a custom action parameter. DIP isolates the document into its own agent cluster, which blocks same-origin iframe access that these editors rely on. Co-Authored-By: Claude Opus 4.6 --- src/wp-includes/media.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/wp-includes/media.php b/src/wp-includes/media.php index efb82399ed688..ee15578d4b0af 100644 --- a/src/wp-includes/media.php +++ b/src/wp-includes/media.php @@ -6430,6 +6430,14 @@ function wp_set_up_cross_origin_isolation(): void { return; } + // Skip when a third-party page builder overrides the block editor. + // DIP isolates the document into its own agent cluster, + // which blocks same-origin iframe access that these editors rely on. + // phpcs:ignore WordPress.Security.NonceVerification.Recommended + if ( isset( $_GET['action'] ) && 'edit' !== $_GET['action'] ) { + return; + } + // Cross-origin isolation is not needed if users can't upload files anyway. if ( ! current_user_can( 'upload_files' ) ) { return;